Computer and Network Security Alberto Marchetti Spaccamela Slides - - PowerPoint PPT Presentation

Computer and Network Security

Alberto Marchetti Spaccamela

Slides are strongly based on material by Amos Fiat

Good crypto courses on the Web with interesting material on web site of:

• Ron Rivest, MIT
• Dan Boneh, Stanford.
• Phil Rogaway, Davis.
• Doug Stinson, Waterloo.
• Amos Fiat, Tel Aviv

Cryptography vs Security

Cryptography and Security differ

• Criptography deals with secrecy of information
• Most real security deals with problems of fraud:
• Message modifications
• User authentication
• Much of Security has little to do with

encryption however it might use cryptography

• Almost invariably, Encryption does not live alone

without some form of authentication

Requirements

This course

 Secrecy of communication (encryption)

 Data integrity (how to check if data are modified maliciously)  Digital signatures (how to sign a digital document)  Authentication (of user)  Standard and real world systems Availability of data, computing power, communications media …???

Encryption: definitions

• Encryption function (& algorithm): E
• Decryption function (& algorithm): D
• Encryption key k1
• Decryption key k2
• Message space (usually binary strings)
• For every message m: Dk2(Ek1 (m)) = m

– Secret key (Symmetric) k1 = k2 – Public key (Asymmetric) k1 ≠ k2

Communication Model

Alice Bob

• 1. Two parties – Alice and Bob
• 2. Reliable communication line
• 3. Shared encryption scheme: E, D, k1, k2
• 4. Goal: send a message m confidentially

Threat (Attack) Model

Alice Bob

• 4. Goal: send a message m confidentially

Trudy (also Eve)

Adversary

• Passive: reads the exchanged messages (no

change) legge il messaggio senza alterarlo (es. password)

• Active:

– Can modify messages sent by Alice or Bob – Can send false (fake) messages claiming that they have sent by some elee (Alice or Bob)

Passive adversary : packet sniffing

A B T

src:B dest:A payload

Trudy reads all messages exchanged by A and B

Active adversary: IP spoofing

T is able to forge messages that look like messages sent by B (modification of IP header)

A B T

src:B dest:A payload

Security Threat: Denial of Service (DoS)

Attcker send many many packets to the attacked host Distributed attack (through infection of unaware computers)

• SYN packets are often used, why?

A B T

SYN SYN SYN SYN SYN SYN SYN

Security goals

If the keys are unknown then

– it is hard to obtain even partial information on the message – It is hard to find the key dedurre la chiave con cui è stato cifrato un documento anche conoscendo il testo in chiaro HARD = Computationally hard: it takes long time even if the most powerful computers are available

Security Goals

Possibilities:

• No adversary can determine m (not enough)
• No adversary can determine any information

about m (not enough)

• No adversary can determine any meaningful

information about m (good)

• Even in probabilistic sense : Adversary with

prob.= 0.50000001 knows one bit of the message)

Adversarial model

• Trudy attempts to discover information

about m

• Trudy knows the algorithms E,D
• Trudy knows the message space
• Trudy has at least partial information

about Ek1(m)

• Trudy does not know k1, k2

Examples – bad ciphers

Shift cipher (Caesar’s cipher)

• 26 keys; easy to check them all
• Conclusion – large key space required

Substitution cipher

• Large key space, still “easy” to break
• (computationally fast/ feasible)

Substitution cipher

Example:

• plaintext: attack at dawn
• ciphertext: waaoq wa vwmk

Size of key space: 26!=403291461126605635584000000 ~ 4 x 1028 large enough

Additional definitions

• Plaintext – the message prior to encryption

(“attack at dawn”, “sell MSFT at 57.5”)

• Ciphertext – the message after encryption

(“ax4erkjpjepmm”,“jhhfoghjklvhgbljhg” )

• Symmetric key – encryption scheme where k1=k2

(classical cryptography)

Perfect Cipher

• Plaintext space – {0,1}n
• Given a ciphertext C the probability that

Dk2(C)=P for any plaintext P is equal to the apriori probability that P is the plaintext. In other words: Pr[plaintext=P|C] = Pr[plaintext=P]

• Probabilities are over the key space and

the plaintext space.

Example – One Time Pad

• Plaintext space - {0,1}n
• Key space - {0,1}n
• The scheme is symmetric, key k is

chosen at random

• Ek(P) = C = P ⊕ K
• Dk(C) = C ⊕ K = P

Pros and Cons

• Claim: the one time pad is a perfect

cipher.

• Problem: size of key space.
• Theorem (Shannon): A cipher cannot

be perfect if its key space is less than the size of its message space.

• Why???

Attack Models

• Eavesdropping
• Known plaintext
• Chosen plaintext
• Chosen ciphertext
• Adaptive chosen text attacks
• Physical access
• “Physical” modification of messages

Computational Power

With sufficient computational power any crypto code can be broken (by trying all possible keys)

• Time
• Hardware
• Storage

When an attack is feasible?

• Theoretical – polynomial time
• Practical (2008) – 264 is feasible, 280 is

infeasible (it requires too long time)

Key lenght

Number of Keys increases over time:

– 20 bit (1 million keys) easy to break – 56 bit (about 66 million of billion of keys) good 15 years ago: today not safe – 512 bit (more than 40000000….0000000000 - 4 followed by 153 zeri - keys) today: safe; tomorrow?

Big numbers

• Enalotto: different columns 622.614.630=1.15 229
• Seconds since the earth exists

1.38 257

• Clocks in a century of a

3 GHz computer 4.05 261

• Clock in a century of 1000000

2 GHz computers 4.05 281

• 249 bit prime numbers of

1.8 2244

• Electrons in the universe

1.8 2258

Course outline

• Encryption (secret key and public key)
• Data integrity
• Digital signature
• User authentication
• Randomness, number theory
• Crypotgraphic protocols (SSL, IPSEC, Kerberos,

X.509)

• Real world security systems
• Other (??): Watermarking, digital rights

management, electronic voting,… ??

Textbook

Network Security: private communication in a public world, 2 ed. Kaufman,Perlman,Speciner, Prentice Hall Slides: Other references:

• Handbook of Applied Cryptography

Menezes, Van Oorschot, Vanstone, CRC Press download http://www.cacr.math.uwaterloo.ca/hac

• Wikipedia

Exam and office hours

• Written exam
• Possible assignment
• Office hour: Tuesday 14.30 or Friday

after class

• E-mail: marchetti@dis.uniroma1.it